US8527756B2 - Security device and building block functions - Google Patents

Security device and building block functions Download PDF

Info

Publication number
US8527756B2
US8527756B2 US11990720 US99072006A US8527756B2 US 8527756 B2 US8527756 B2 US 8527756B2 US 11990720 US11990720 US 11990720 US 99072006 A US99072006 A US 99072006A US 8527756 B2 US8527756 B2 US 8527756B2
Authority
US
Grant status
Grant
Patent type
Prior art keywords
secure module
sequence
dynamically generated
generated pseudo
software primitives
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active, expires
Application number
US11990720
Other versions
US20100153717A1 (en )
US20110271104A9 (en )
Inventor
Leonid Sandler
Yaron Sella
Erez Waisbard
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Cisco Technology Inc
Original Assignee
Cisco Technology Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Grant date

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/04Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0485Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10Protecting distributed programs or content, e.g. vending or licensing of copyrighted material
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31User authentication
    • G06F21/34User authentication involving the use of external additional devices, e.g. dongles or smart cards
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/51Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communication
    • H04L9/08Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04NPICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00Selective content distribution, e.g. interactive television, VOD [Video On Demand]
    • H04N21/40Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
    • H04N21/41Structure of client; Structure of client peripherals
    • H04N21/418External card to be used in combination with the client device, e.g. for conditional access
    • H04N21/4181External card to be used in combination with the client device, e.g. for conditional access for conditional access
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/07Indexing scheme relating to G06F21/10, protecting distributed programs or content
    • G06F2221/0751Key
    • G06F2221/0753Distribution
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2105Dual mode as a secondary aspect
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2143Clearing memory, e.g. to prevent the data from being stolen
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for supporting authentication of entities communicating through a packet data network

Abstract

A method and system of securing content is described, the method including establishing communication between a secure module source and a content rendering device, loading a dynamically generated pseudo-unique secure module to the content rendering device from the secure module source, establishing communication between the secure module source and the dynamically generated pseudo-unique secure module, and transferring a decryption key from the secure module source to the dynamically generated pseudo-unique secure module, thereby enabling decryption of encrypted content, the encrypted content being encrypted according to the decryption key. Related methods and apparatus are also described.

Description

RELATED APPLICATION INFORMATION

The present application is a 35 USC §371 application of PCT/IL2006/001133, filed on 27 Sep. 2006 and entitled “Security Device and Building Block Functions”, which was published in the English language with International Publication Number WO 2007/039896, and which claims the benefit of priority based on U.S. Provisional Patent Application Ser. No. 60/724,342, filed 6 Oct. 2005, entitled, “Security Device and Building Block Functions”.

FIELD OF THE INVENTION

The present invention relates to securing content on a computer, and more particularly, to securing content on a computer using a security device, such as a dongle or a smart card.

BACKGROUND OF THE INVENTION

U.S. Pat. No. 5,182,770 to Medveczky, et al., describes an integrated software piracy prevention system incorporating several characteristic identification codes identifying installation and software components. A separate security device is attached to and in communication with the protected computer system. It is interactively queried regarding proper authorization of the current user. This approach provides economical tracking of licensees and their use of sophisticated programs.

U.S. Pat. No. 5,857,025 to Anderson, et al., describes using a device and method using a split processor based architecture to provide physical security of critical information by implementing a required protocol before releasing critical information. The critical information is used as a key to a cryptographic algorithm. A chaotic cryptographic algorithm is also provided including a defined key space employing six parameters of a Lorenzian system of equations.

U.S. Pat. No. 6,088,450 to Davis, et al., describes a wireless authentication system to control an operating state of a node being a computer, door control mechanism or any multi-state product based on the proximity of an authorized user to the node. The wireless authentication system comprises a security device implemented within the computer and a user authentication token (“token”) in possession of the authorized user. A Challenge/Response protocol is configured between the security device and the token. The first successful Challenge/Response message exchange between the security device and the token places the node in an operational state allowing the authorized user access to the contents and/or networked resources of the node. Later Challenge/Response message exchanges are set to occur periodically to check whether the authorized user possessing the token has left the node unattended thereby causing the node to be placed in a non-operational state.

The FROG block cipher (see tecapro.com/aesfrog.html) is a block cipher which hides the exact sequence of primitive operations even though the cipher itself is known. When other ciphers use the secret key only as data (which are combined with the plaintext to produce the ciphertext) FROG uses the key both as data and as instructions on how to combine these data. In effect an expanded version of the key is used by FROG as a program. FROG itself operates as an interpreter that applies this key-dependent program on the plaintext to produce the ciphertext.

The disclosures of all references mentioned above and throughout the present specification, as well as the disclosures of all references mentioned in those references, are hereby incorporated herein by reference.

SUMMARY OF THE INVENTION

The present invention seeks to provide an improved method and system of using a security device, such as a dongle or smart card, in order to secure content consumption on a general purpose computer or other content rendering device.

The term “render”, as in “content rendering device”, in all of its grammatical forms, as used herein in the present specification and claims, is understood to refer to any appropriate mechanism or method of making content palpable to one or more of the senses. In particular and without limiting the generality of the foregoing, “render” refers not only to display of video content but also to playback of audio content.

There is thus provided in accordance with a preferred embodiment of the present invention a method of securing content, the method including establishing communication between a secure module source and a content rendering device, loading a dynamically generated pseudo-unique secure module to the content rendering device from the secure module source, establishing communication between the secure module source and the dynamically generated pseudo-unique secure module, and transferring a decryption key from the secure module source to the dynamically generated pseudo-unique secure module, thereby enabling decryption of encrypted content, the encrypted content being encrypted according to the decryption key.

Further in accordance with a preferred embodiment of the present invention the secure module source includes a security device.

Still further in accordance with a preferred embodiment of the present invention the secure module source includes a remote server.

Additionally in accordance with a preferred embodiment of the present invention the method includes establishing a first secure authenticated channel for secure communication between the secure module source and the content rendering device.

Moreover in accordance with a preferred embodiment of the present invention the method includes establishing a second secure authenticated channel for secure communication between the secure module source and the dynamically generated pseudo-unique secure module.

Further in accordance with a preferred embodiment of the present invention the content rendering device also includes a secure software agent.

Still further in accordance with a preferred embodiment of the present invention the establishing the first secure authenticated channel includes establishing the first secure authenticated channel between the secure module source and the secure software agent.

Additionally in accordance with a preferred embodiment of the present invention the content rendering device includes a general purpose computer.

Moreover in accordance with a preferred embodiment of the present invention the content rendering device includes a set top box (STB).

Further in accordance with a preferred embodiment of the present invention the content rendering device includes a digital video recorder (DVR).

Still further in accordance with a preferred embodiment of the present invention the content rendering device includes a DVD player.

Additionally in accordance with a preferred embodiment of the present invention the dynamically generated pseudo-unique secure module includes a sequence of software primitives, each one of the sequence of software primitives being capable of being sequentially executed, and an output from a first one of the plurality of software primitives includes an input to a second one of the plurality of software primitives.

Moreover in accordance with a preferred embodiment of the present invention the dynamically generated pseudo-unique secure module is produced by providing a plurality of software primitives to the secure module source, and combining a sequence of software primitives from among the plurality of software primitives in order to form the dynamically generated pseudo-unique secure module, wherein each software primitive from among the plurality of software primitives includes a software primitive which can be sequentially executed, and an output from a first one of the plurality of software primitives includes an input to a second one of the plurality of software primitives.

There is also provided in accordance with another preferred embodiment of the present invention a method of securing content, the method including establishing communication between a secure module source and a content rendering device, loading a dynamically generated pseudo-unique secure module to the content rendering device from the secure module source, establishing communication between the secure module source and the dynamically generated pseudo-unique secure module, and transferring a decryption key from the secure module source to the dynamically generated pseudo-unique secure module, thereby enabling decryption of encrypted content, the encrypted content being encrypted according to the decryption key, wherein the dynamically generated pseudo-unique secure module includes a sequence of software primitives, each one of the sequence of software primitives being capable of being sequentially executed, and an output from a first one of the plurality of software primitives includes an input to a second one of the plurality of software primitives.

Further in accordance with a preferred embodiment of the present invention the dynamically generated pseudo-unique secure module is produced by providing a plurality of software primitives to the secure module source, and combining a sequence of software primitives from among the plurality of software primitives in order to form the dynamically generated pseudo-unique secure module, wherein each software primitive includes a software primitive which can be sequentially executed, and an output from a first one of the plurality of software primitives includes an input to a second one of the plurality of software primitives.

There is also provided in accordance with still another preferred embodiment of the present invention a method of constructing a dynamically generated pseudo-unique secure module, the method including providing a plurality of software primitives to a secure module source, and combining a sequence of software primitives from among the plurality of software primitives in order to form a secure module, wherein each software primitive includes a software primitive which can be sequentially executed, and an output from a first one of the plurality of software primitives includes an input to a second one of the plurality of software primitives.

Further in accordance with a preferred embodiment of the present invention the method includes receiving an initial input, inputting the initial input to the first one of the plurality of software primitives, sequentially inputting the output from a prior one of the plurality of software primitives to a next one of the plurality of software primitives until a final one of the plurality of software primitives produces a final output, and outputting the final output.

Still further in accordance with a preferred embodiment of the present invention the secure module produces a result based, at least in part, on the initial input.

Additionally in accordance with a preferred embodiment of the present invention the result is also based, at least in part, on an order of the plurality of software primitives.

Moreover in accordance with a preferred embodiment of the present invention at least one of the software primitives includes a hash function.

Further in accordance with a preferred embodiment of the present invention all of the software primitives including the plurality of software primitives must be used in order to form the secure module.

Still further in accordance with a preferred embodiment of the present invention each one of the plurality of software primitives must be used once and only once in order to form the secure module.

Additionally in accordance with a preferred embodiment of the present invention each one of the plurality of software primitives may be used more than once in order to form the secure module.

Moreover in accordance with a preferred embodiment of the present invention any subset of the software primitives including the plurality of software primitives may be used in order to form the secure module.

Further in accordance with a preferred embodiment of the present invention a minimum number of the software primitives including the plurality of software primitives are used in order to form the secure module.

Still further in accordance with a preferred embodiment of the present invention the secure module is operative to decrypt an encrypted message.

Additionally in accordance with a preferred embodiment of the present invention the encrypted message includes content.

Moreover in accordance with a preferred embodiment of the present invention the secure module source includes a security device.

Further in accordance with a preferred embodiment of the present invention the secure module source includes a remote server.

There is also provided in accordance with still another preferred embodiment of the present invention an apparatus for securing content, the apparatus including a first communication mechanism operative to establish communication between a secure module source and a content rendering device, a dynamically generated pseudo-unique secure module loader operative to load a dynamically generated pseudo-unique secure module to the content rendering device from the secure module source, a second communication mechanism operative to establish communication between the secure module source and the dynamically generated pseudo-unique secure module, and a decryption key transferring mechanism operative to transfer a decryption key from the secure module source to the dynamically generated pseudo-unique secure module, thereby enabling decryption of encrypted content, the encrypted content being encrypted according to the decryption key.

There is also provided in accordance with still another preferred embodiment of the present invention an apparatus for securing content, the apparatus including a first communication mechanism operative to establish communication between a secure module source and a content rendering device, a dynamically generated pseudo-unique secure module loader operative to load a dynamically generated pseudo-unique secure module to the content rendering device from the secure module source, a second communication mechanism operative to establish communication between the secure module source and the dynamically generated pseudo-unique secure module, and a decryption key transferring mechanism operative to transfer a decryption key from the secure module source to the dynamically generated pseudo-unique secure module, thereby enabling decryption of encrypted content, the encrypted content being encrypted according to the decryption key, wherein the dynamically generated pseudo-unique secure module includes a sequence of software primitives, each one of the sequence of software primitives being capable of being sequentially executed, and an output from a first one of the plurality of software primitives includes an input to a second one of the plurality of software primitives.

There is also provided in accordance with still another preferred embodiment of the present invention a system for constructing a dynamically generated pseudo-unique secure module, the system including a plurality of software primitives included at a secure module source, and a combiner for combining a sequence of software primitives from among the plurality of software primitives in order to form a secure module, wherein each software primitive from plurality of software primitives among the includes a software primitive which can be sequentially executed, and an output from a first one of the plurality of software primitives includes an input to a second one of the plurality of software primitives.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will be understood and appreciated more fully from the following detailed description, taken in conjunction with the drawings in which:

FIG. 1 is a simplified block diagram illustration of a security system constructed and operative in accordance with a preferred embodiment of the present invention;

FIG. 2 is a simplified illustration diagramming communication between the secure module source and a content rendering device of FIG. 1; and

FIGS. 3-5 are simplified flowchart diagrams of preferred methods of operation of the system of FIG. 1.

DETAILED DESCRIPTION OF A PREFERRED EMBODIMENT

Reference is now made to FIG. 1, which is a simplified block diagram illustration of a security system constructed and operative in accordance with a preferred embodiment of the present invention. The system of FIG. 1 comprises a secure module source 10, a secure software agent 20, and a secure module 30.

The secure module 30 preferably comprises a dynamically generated pseudo-unique software module which is dynamically loaded or appended by the secure software agent 20 at run time. For example and without limiting the generality of the foregoing, the secure module 30 preferably comprises an operation system independent and execution location independent code fragment.

The secure module 30 is preferably sent by the secure module source 10 to a secure software agent 20 comprised in a general purpose computer or other content rendering device 40. In some preferred embodiments of the present invention, the secure module source 10 preferably comprises a security device. For example and without limiting the generality of the foregoing, the secure device may comprise a dongle, as is known in the art.

In alternative preferred embodiments of the present invention, the secure module source 10 preferably comprises a remote server. For example and without limiting the generality of the foregoing, the remote server may comprise a broadcast headend or a content provider. If the secure module source 10 is connected to the remote server, the secure module source 10 preferably communicates with the content rendering device 40 over a LAN or a global network, such as, but not limited to, the Internet.

Non-limiting examples of a content rendering device include such devices as a general purpose computer, a set top box (STB), a digital video recorder (DVR), and a DVD player. The secure software agent 20 is operatively associated with “media player”-like software, or, in some preferred embodiments, a codec of the “media player”-like software comprised on the computer or content rendering device.

Those skilled in the art will appreciate that, in general, key distribution typically preferably occurs between security devices or secure servers. The present invention, in preferred embodiments thereof, preferably enables a method of transfer of content encryption keys from the secure module source 10 to the content rendering device 40.

It is further appreciated that a software application designed to play content on the content rendering device 40 may preferably comprise a software application. In such a case, upon arrival of the secure module 30 from the secure module source 10, the secure module 30 then enables the software application, enabling use of the content rendering device 40.

A preferred method of forming the secure module 30 is now described. The secure module 30 preferably comprises a pseudo-unique security function. The pseudo-unique security function is preferably constructed utilizing a plurality of software primitives available to the secure module source 10. Each primitive of the plurality of software primitives is preferably capable of being combined with any other of the plurality of software primitives. For example and without limiting the generality of the foregoing, each primitive can be executed sequentially. A subset or sequence of the plurality of primitives is preferably combined in a random or pseudo-random fashion in order to comprise the secure module 30. For example and without limiting the generality of the foregoing, each primitive of the plurality of software primitives may comprise a well known hash function with a specific initial value.

The software primitives can be used in any order at all and may be repeated. For example, if there are five software primitives, A, B, C, D, and E, and up to five software primitives must be combined in order to comprise the secure module 30, and not all of the primitives need to be used, the secure module 30 may comprise, for instance:

    • ACDBE;
    • D;
    • AEA; and
    • EBAAC.

It is appreciated that combining individual primitives from among the plurality of software primitives as described herein can produce a very large number of combinations of primitives. For example and without limiting the generality of the foregoing, if there are 32 primitives available to the security device, and each one of the 32 primitives should be used once and only once, and the order the 32 primitives are used in does not matter, there are 32! possible combinations of primitives.

In some embodiments of the present invention, some of the plurality of software primitives available to, and stored on, the secure module source 10 are preferably encrypted, while others of the plurality of software primitives available to the secure module source 10 are preferably not encrypted. The encrypted primitives are preferably encrypted using different encryption keys, and are either encrypted in such a fashion that the encryption keys are preferably not available to the secure module source 10 itself, but are preferably stored at a central authority, such as a broadcast headend. Alternatively, the encrypted software primitives are preferably locally encrypted. Thus, in the event of a reverse engineering attack on the security device, it will preferably be very difficult to discover a full set of the software primitives. In some preferred embodiments of the present invention, when the secure module source 10 needs to assemble a secure module 30 to be sent to the secure software agent 20, the secure module source 10 preferably receives all the required decryption keys from the central authority. In the event that the secure module source 10 receives all of the required decryption keys from the central authority, the secure module source 10 preferably uses the decrypted primitives for secure module 30 construction. If, for some reason, no decryption key is available, the secure module source 10 preferably uses only unencrypted primitives for secure module 30 construction. It is appreciated that the required decryption keys are preferably securely delivered from the central authority under the protection of an appropriate secure delivery scheme, such as a conditional access system.

It is appreciated that the secure module 30 is preferably able to perform other security functions in addition to content decryption, as described above. For example and without limiting the generality of the foregoing, in addition to content decryption, the secure module 30 is preferably also able to perform at least: key management and calculation; content decoding; and license enforcement.

The secure module source 10 preferably episodically shuffles the plurality of software primitives such that software primitives that were once encrypted become non-encrypted, and software primitives which were non-encrypted become encrypted using the same key provided by the central authority.

It is also appreciated that certain individual primitives among the plurality of software primitives may preferably comprise functions producing the same result, but comprising different programming code, and thus comprising different programming code patterns (also known in the art as “code signatures”).

The secure module 30, when sent to the content rendering device 40, will preferably communicate with the secure module source 10, and negotiate for a delivery of the content encryption key. The secure module 30 also preferably comprises executable computer code operative to decrypt encrypted content. The secure module 30 still further preferably comprises content access business rules, for example and without limiting the generality of the foregoing, a content expiration date, after which the content may no longer be consumed. An executable portion of the secure module 30 will therefore preferably be different, or pseudo-unique, for each content encryption key transfer. Therefore, it is necessary to intercept or steal and reverse engineer each individual secure module 30 for each individual content key.

In order to complicate any attempts at reverse engineering the security module 30, the secure module source 10 preferably allows a limited time window for the secure module 30 to run. The secure module source 10 preferably limits response time by running an internal timer. It is appreciated that the internal timer preferably comprises a secure timer. The secure module 30 must prove to the secure module source 10 that the secure module 30 has finished running, preferably by presenting a result of a calculation to the secure module source 10 before the termination of the limited time window. In the event that the secure module 30 fails to present the result of the calculation to the secure module source 10 before the termination of the limited time window, the secure module source 10 will not return the encryption key.

Returning to the discussion of FIG. 1, in a first stage of communication between the secure module source 10 and the content rendering device 40, a first level secure authenticated channel (SAC) 50 is preferably established between the secure software agent 20 and the secure module source 10. Then, via the first level SAC 50, the secure module 30, comprising the pseudo-unique security function is uploaded from the secure module source 10 to the content rendering device 40.

In a second stage of communication between the secure module source 10 and the content rendering device 40, a second level SAC 60 is preferably established between the secure module 30 comprised in the content rendering device 40 and the secure module source 10, using the pseudo-unique security function as described herein.

Those skilled in the art will appreciate that the secure module source 10 preferably constructs, for its own use, exactly the same pseudo-unique security function as the content rendering device 40 is using in the secure module 30, in order to enable the secure module source 10 to properly communicate with the secure module 30.

After the second level SAC 60 is established between the secure module source 10 and the secure module 30, the secure module source 10 preferably is able to provide at least one content decryption key to the secure module 30. The secure module 30 preferably either performs or controls decryption of content.

Reference is now additionally made to FIG. 2, which is a simplified illustration diagramming communication between the secure module source 10 and a content rendering device 40 of FIG. 1.

In a first stage of communication between the secure module source 10 and the content rendering device 40, a communication handshake preferably takes place (step 210). Specifically, the secure module source 10 establishes communication with the secure software agent 20 comprised in the content rendering device 40. Upon completion of the handshake, the first level SAC 50 is established between the secure module source 10 and the secure software agent 20 (step 220). Once the first level SAC 50 is established, the secure module 30 is uploaded from the secure module source 10 to the content rendering device 40 (step 230).

Once the secure module 30 is uploaded from the secure module source 10 to the content rendering device 40, the secure module source 10 communicates directly with the secure module 30. During the first stage of communication between the secure module source 10 and the secure module 30, a communication handshake preferably takes place (step 240). Upon completion of the handshake, the second level SAC 60 is preferably established between the secure module source 10 and the secure module 30 (step 250). The secure module source 10 preferably securely transfers the least one content decryption key to the secure module 30 (step 260). Upon receipt of the at least one content decryption key by the secure module 30, the secure module 30 is preferably able to decrypt encrypted content 70 (step 270), thereby producing clear content 80, for rendering by the content rendering device 40.

FIGS. 3-5 are simplified flowchart diagrams of preferred methods of operation of the system of FIG. 1. The methods of FIGS. 3-5 are believed to be self explanatory in light of the above discussion.

It is appreciated that software components of the present invention may, if desired, be implemented in ROM (read only memory) form. The software components may, generally, be implemented in hardware, if desired, using conventional techniques.

It is appreciated that various features of the invention which are, for clarity, described in the contexts of separate embodiments may also be provided in combination in a single embodiment. Conversely, various features of the invention which are, for brevity, described in the context of a single embodiment may also be provided separately or in any suitable subcombination.

It will be appreciated by persons skilled in the art that the present invention is not limited by what has been particularly shown and described hereinabove. Rather the scope of the invention is defined only by the claims which follow:

Claims (35)

The invention claimed is:
1. A method of securing content, the method comprising:
establishing communication between a secure module source and a content rendering device;
producing a dynamically generated pseudo-unique secure module by:
providing a plurality of available individual software primitives to the secure module source; and
combining a sequence of software primitives from among the plurality of available individual software primitives, where the sequence may combine any of the available individual software primitives in any order at all, where any of the available individual software primitives may be repeated in the sequence, and where the sequence does not have to include all of the available individual software primitives, so that the sequence thereby can be any one of a large number of possible combinations of the available individual software primitives;
loading the dynamically generated pseudo-unique secure module to the content rendering device from the secure module source, the dynamically generated pseudo-unique secure module comprising the sequence of software primitives;
after the loading step, establishing communication between the secure module source and the dynamically generated pseudo-unique secure module; and
after the step of establishing communication between the secure module source and the dynamically generated pseudo-unique secure module, transferring a decryption key from the secure module source to the dynamically generated pseudo-unique secure module, thereby enabling decryption of encrypted content, the encrypted content being encrypted according to the decryption key,
wherein each one of the sequence of software primitives is sequentially executed, and an output from a first one of the sequence comprises an input to a second one of the sequence.
2. The method according to claim 1 and wherein the secure module source comprises a security device.
3. The method according to claim 1 and wherein the secure module source comprises a remote server.
4. The method according to claim 1 and also comprising establishing a first secure authenticated channel for secure communication between the secure module source and the content rendering device.
5. The method according to claim 4 and wherein the content rendering device also comprises a secure software agent.
6. The method according to claim 5 and wherein the establishing the first secure authenticated channel comprises establishing the first secure authenticated channel between the secure module source and the secure software agent.
7. The method according to claim 1 and also comprising establishing a second secure authenticated channel for secure communication between the secure module source and the dynamically generated
pseudo-unique secure module.
8. The method according to claim 1 and wherein the content rendering device comprises a general purpose computer.
9. The method according to claim 1 and wherein the content rendering device comprises a set top box (STB).
10. The method according to claim 1 and wherein the content rendering device comprises a digital video recorder (DVR).
11. The method according to claim 1 and wherein the content rendering device comprises a DVD player.
12. The method according to claim 1 and further comprising:
inputting an initial input to the first one of the sequence; and
sequentially inputting an output from a prior one of the sequence to a next one of the sequence until a final one of the sequence produces a final output.
13. The method according to claim 1 and wherein the dynamically generated pseudo-unique secure module produces a result based, at least in part, on an initial input.
14. The method according to claim 13 and wherein the result is also based, at least in part, on an order of the plurality of the software
primitives within the sequence.
15. The method according to claim 1 and wherein at least one of the software primitives comprises a hash function.
16. The method according to claim 1, wherein the dynamically generated pseudo-unique secure module is able to perform content decryption, key management and calculation, content decoding, and license enforcement.
17. The method according to claim 1, wherein the dynamically generated pseudo-unique secure module comprises a content access
business rule.
18. The method according to claim 1, wherein the dynamically generated pseudo-unique secure module comprises a content expiration date, after which content may no longer be consumed.
19. The method according to claim 1, further comprising:
after the step of establishing communication between the secure module source and the dynamically generated pseudo-unique secure module, transmitting a result of a calculation from the dynamically generated pseudo-unique secure module to the secure module source;
wherein the transferring step is performed only if the result of the calculation is transmitted to the secure module source before termination of a limited time window.
20. The method according to claim 1 wherein some of the software primitives are stored encrypted at the secure module source, and some of the software primitives are stored not encrypted.
21. The method according to claim 20 wherein at least one of the software primitives which are stored encrypted at the secure module source are encrypted according to a first encryption key and at least a second one of the software primitives which are stored encrypted at the secure module source are encrypted according to a second encryption key.
22. Apparatus for securing content, the apparatus comprising:
a dynamically generated pseudo-unique secure module loader operative to load a dynamically generated pseudo-unique secure module to a content rendering device from a secure module source, the dynamically generated pseudo-unique secure module comprising a sequence of software primitives from among a plurality of available individual software primitives, where the sequence may combine any of the available individual software primitives in any order at all, where any of the available individual software primitives may be repeated in the sequence, and where the sequence does not have to include all of the available individual software primitives, so that the sequence thereby can be any one of a large number of possible combinations of the available individual software primitives;
a communication mechanism operative (a) to establish communication between the secure module source and the content rendering device, and (b) to establish communication between the secure module source and the dynamically generated pseudo-unique secure module after the dynamically generated pseudo-unique secure module has been loaded to the content rendering device from the secure module source; and
a decryption key transferring mechanism operative to transfer a decryption key from the secure module source to the dynamically generated pseudo-unique secure module after the dynamically generated pseudo-unique secure module has been loaded to the content rendering device from the secure module source, thereby enabling decryption of encrypted content, the encrypted content being encrypted according to the decryption key,
wherein the dynamically generated pseudo-unique secure module comprises the sequence of software primitives, each one of the sequence of software primitives being capable of being sequentially executed, and an output from a first one of the sequence comprises an input to a second one of the sequence.
23. Apparatus for securing content, the apparatus comprising:
means for loading a dynamically generated pseudo-unique secure module to a content rendering device from a secure module source, the dynamically generated pseudo-unique secure module comprising a sequence of software primitives from among a plurality of available individual software primitives, where the sequence may combine any of the available individual software primitives in any order at all, where any of the available individual software primitives may be repeated in the sequence, and where the sequence does not have to include all of the available individual software primitives, so that the sequence thereby can be any one of a large number of possible combinations of the available individual software primitives;
a communication means (a) for establishing communication between the secure module source and the content rendering device, and (b) for establishing communication between the secure module source and the dynamically generated pseudo-unique secure module after the dynamically generated pseudo-unique secure module has been loaded to the content rendering device from the secure module source; and
means for transferring a decryption key from the secure module source to the dynamically generated pseudo-unique secure module after the dynamically generated pseudo-unique secure module has been loaded to the content rendering device from the secure module source, thereby enabling decryption of encrypted content, the encrypted content being encrypted according to the decryption key,
wherein each one of the sequence of software primitives is sequentially executed, and an output from a first one of the sequence comprises an input to a second one of the sequence.
24. A method of securing content, the method comprising:
establishing communication between a secure module source and a content rendering device;
loading a dynamically generated pseudo-unique secure module to the content rendering device from the secure module source, the dynamically generated pseudo-unique secure module comprising a sequence of software primitives from among a plurality of available individual software primitives, where the sequence may combine any of the available individual software primitives in any order at all, where any of the available individual software primitives may be repeated in the sequence, and where the sequence does not have to include all of the available individual software primitives, so that the sequence thereby can be any one of a large number of possible combinations of the available individual software primitives;
after the loading step, establishing communication between the secure module source and the dynamically generated pseudo-unique secure module; and
after the step of establishing communication between the secure module source and the dynamically generated pseudo-unique secure module, transferring a decryption key from the secure module source to the dynamically generated pseudo-unique secure module, thereby enabling decryption of encrypted content, the encrypted content being encrypted according to the decryption key;
wherein each one of the sequence of the software primitives can be sequentially executed, and an output from a first one of the sequence comprises an input to a second one of the sequence.
25. The method according to claim 24 and further comprising:
inputting an initial input to the first one of the sequence; and
sequentially inputting an output from a prior one of the sequence to a next one of the sequence until a final one of the sequence produces a final output.
26. The method according to claim 25 and wherein the dynamically generated pseudo-unique secure module produces a result based, at least in part, on the initial input.
27. The method according to claim 26 and wherein the result is also based, at least in part, on an order of the plurality of the software
primitives.
28. The method according to claim 24 and wherein at least one of the software primitives comprises a hash function.
29. The method according to claim 24 and wherein all of the available software primitives comprising the plurality of the available software primitives must be used in order to form the dynamically generated pseudo-unique secure module.
30. The method according to claim 29 and wherein each one of the plurality of the available software primitives must be used once and only once in order to form the dynamically generated pseudo-unique secure module.
31. The method according to claim 29 and wherein each one of the plurality of the available software primitives may be used more than once in order to form the dynamically generated pseudo-unique secure module.
32. The method according to claim 24 and wherein a minimum number of the available software primitives comprising the plurality of the available software primitives are used in order to form the dynamically generated pseudo-unique secure module.
33. The method according to claim 24 and wherein the secure module source comprises a security device.
34. The method according to claim 24 and wherein the secure module source comprises a remote server.
35. The method according to claim 24, wherein one individual primitive among the plurality of the available software primitives comprises different programming code than another individual primitive among the plurality of the available sol, ware primitives comprises, but each of said one and said other individual primitives comprises a function producing the same result.
US11990720 2005-10-06 2006-09-27 Security device and building block functions Active 2030-11-05 US8527756B2 (en)

Priority Applications (3)

Application Number Priority Date Filing Date Title
US72434205 true 2005-10-06 2005-10-06
US11990720 US8527756B2 (en) 2005-10-06 2006-09-27 Security device and building block functions
PCT/IL2006/001133 WO2007039896A3 (en) 2005-10-06 2006-09-27 Security device and building block functions

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
US11990720 US8527756B2 (en) 2005-10-06 2006-09-27 Security device and building block functions

Publications (3)

Publication Number Publication Date
US20100153717A1 true US20100153717A1 (en) 2010-06-17
US20110271104A9 true US20110271104A9 (en) 2011-11-03
US8527756B2 true US8527756B2 (en) 2013-09-03

Family

ID=37906563

Family Applications (1)

Application Number Title Priority Date Filing Date
US11990720 Active 2030-11-05 US8527756B2 (en) 2005-10-06 2006-09-27 Security device and building block functions

Country Status (4)

Country Link
US (1) US8527756B2 (en)
EP (1) EP1932275B1 (en)
CN (1) CN101278517B (en)
WO (1) WO2007039896A3 (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130219188A1 (en) * 2012-02-16 2013-08-22 Samsung Electronics Co. Ltd. Apparatus and method for reproducing contents in electronic device

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8971535B2 (en) * 2010-05-27 2015-03-03 Bladelogic, Inc. Multi-level key management
EP2564343B1 (en) 2010-10-21 2016-11-09 NDS Limited Code diversity method and system
US8862882B2 (en) * 2012-06-29 2014-10-14 Intel Corporation Systems and methods for authenticating devices by adding secure features to Wi-Fi tags
CN103780377B (en) * 2014-01-09 2017-07-14 宇龙计算机通信科技(深圳)有限公司 A method of processing confidential data and system
US20150215293A1 (en) * 2014-01-29 2015-07-30 Intertrust Technologies Corporation Secure Application Processing Systems and Methods

Citations (44)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5182770A (en) 1991-04-19 1993-01-26 Geza Medveczky System and apparatus for protecting computer software
US5857025A (en) 1996-09-09 1999-01-05 Intelligent Security Systems, Inc. Electronic encryption device and method
US6088450A (en) 1996-04-17 2000-07-11 Intel Corporation Authentication system based on periodic challenge/response protocol
JP2000295212A (en) 1999-04-01 2000-10-20 Hitachi Ltd Method and device for decoding processing of encrypted data
WO2003024138A1 (en) 2001-09-07 2003-03-20 Telefonaktiebolaget L M Ericsson (Publ) Dynamic security model
US20030123665A1 (en) * 2001-12-28 2003-07-03 Dunstan Robert A. Secure delivery of encrypted digital content
US20030135730A1 (en) * 2001-10-19 2003-07-17 Paul Szucs Content protection and copy management system for a network
US6598161B1 (en) * 1999-08-09 2003-07-22 International Business Machines Corporation Methods, systems and computer program products for multi-level encryption
US6598163B1 (en) 1999-08-02 2003-07-22 Lucent Technologies Inc. Flash mixing apparatus and method
US20030177381A1 (en) * 2002-03-16 2003-09-18 Yoram Ofek Trusted communications system
US20030223582A1 (en) * 2002-05-31 2003-12-04 Amit Dagan Fast-software-implemented pseudo-random code generator
US20040022271A1 (en) * 1997-03-21 2004-02-05 Laurent Fichet Signal generation and broadcasting
US20040026502A1 (en) * 2000-08-17 2004-02-12 Tame Gavin Randall Transfer of verification data
US6694436B1 (en) * 1998-05-22 2004-02-17 Activcard Terminal and system for performing secure electronic transactions
US20040068541A1 (en) * 1997-03-21 2004-04-08 Mulham Bayassi Broadcast and reception, and conditional access system therefor
US20040083380A1 (en) * 2001-02-16 2004-04-29 Marcus Janke Security module with volatile memory for storing an algorithm code
US20040168063A1 (en) * 2003-01-31 2004-08-26 Dan Revital Virtual smart card device, method and system
US6813354B1 (en) 2000-03-09 2004-11-02 Lucent Technologies Inc. Mixing in small batches
US20040220985A1 (en) * 2003-05-02 2004-11-04 Morris John R. System and method for producing functions for generating pseudo-random bit sequences
US20040230797A1 (en) * 2002-03-16 2004-11-18 Yoram Ofek Remotely authenticated operation method
US20040237100A1 (en) * 2002-05-24 2004-11-25 Pinder Howard G. Validating client-receivers
US6845159B1 (en) 1998-10-07 2005-01-18 Protego Information Ab Processing method and apparatus for converting information from a first format into a second format
US20050037735A1 (en) * 2003-07-31 2005-02-17 Ncr Corporation Mobile applications
US20050041955A1 (en) * 1998-03-25 2005-02-24 Canal+ Societe Anonyme Authentification of data in a digital transmission system
US20050060525A1 (en) * 2003-09-12 2005-03-17 Schwartz James A. Language for performing high level actions using hardware registers
WO2005031593A1 (en) 2003-09-30 2005-04-07 Inka Entworks, Inc. A method of synchronizing data between contents providers and a portable device via network and a system thereof
US20050132207A1 (en) 2003-12-10 2005-06-16 Magda Mourad System and method for authoring learning material using digital ownership rights
US20050131832A1 (en) * 2000-06-16 2005-06-16 Entriq Inc., Irdeto Access B.V. Separate authentication processes to secure content
US20050185647A1 (en) * 2003-11-11 2005-08-25 Rao Goutham P. System, apparatus and method for establishing a secured communications link to form a virtual private network at a network protocol layer other than at which packets are filtered
US20050193191A1 (en) * 2004-02-27 2005-09-01 Sturgis Rod D. Method of identifying participants in secure web sessions
US20050232416A1 (en) * 2004-04-19 2005-10-20 Infineon Technologies Ag Method and device for determining a result
US20060026688A1 (en) * 2004-08-02 2006-02-02 Pinkesh Shah Methods, systems and computer program products for evaluating security of a network environment
US20060090209A1 (en) * 2004-10-27 2006-04-27 Garay Juan A Method and apparatus for software integrity protection using timed executable agents
US20060109101A1 (en) * 2004-11-19 2006-05-25 Nec Corporation Security system
US20060184796A1 (en) * 2005-02-16 2006-08-17 Comcast Cable Holdings, Llc System and method for a variable key ladder
US20060200410A1 (en) * 2005-03-02 2006-09-07 International Business Machines Corporation Secure cell phone for atm transactions
US20060205516A1 (en) * 2002-07-15 2006-09-14 Imagination Dvd Corp. Media playing system and process
US20060230102A1 (en) * 2005-03-25 2006-10-12 Murray Hidary Automated training program generation and distribution system
US7124938B1 (en) * 1999-03-24 2006-10-24 Microsoft Corporation Enhancing smart card usage for associating media content with households
US20060294312A1 (en) * 2004-05-27 2006-12-28 Silverbrook Research Pty Ltd Generation sequences
US7245819B1 (en) * 2003-03-24 2007-07-17 Microsoft Corporation Cross-file DVR record padding playback
US20070220500A1 (en) * 2006-03-20 2007-09-20 Louisa Saunier Computer security method and computer system
US20070242039A1 (en) * 2006-04-17 2007-10-18 Mike Chen Pointing device with security capabilities
US7430670B1 (en) * 1999-07-29 2008-09-30 Intertrust Technologies Corp. Software self-defense systems and methods

Patent Citations (45)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5182770A (en) 1991-04-19 1993-01-26 Geza Medveczky System and apparatus for protecting computer software
US6088450A (en) 1996-04-17 2000-07-11 Intel Corporation Authentication system based on periodic challenge/response protocol
US5857025A (en) 1996-09-09 1999-01-05 Intelligent Security Systems, Inc. Electronic encryption device and method
US20040022271A1 (en) * 1997-03-21 2004-02-05 Laurent Fichet Signal generation and broadcasting
US20040068541A1 (en) * 1997-03-21 2004-04-08 Mulham Bayassi Broadcast and reception, and conditional access system therefor
US20050041955A1 (en) * 1998-03-25 2005-02-24 Canal+ Societe Anonyme Authentification of data in a digital transmission system
US6694436B1 (en) * 1998-05-22 2004-02-17 Activcard Terminal and system for performing secure electronic transactions
US6845159B1 (en) 1998-10-07 2005-01-18 Protego Information Ab Processing method and apparatus for converting information from a first format into a second format
US7124938B1 (en) * 1999-03-24 2006-10-24 Microsoft Corporation Enhancing smart card usage for associating media content with households
JP2000295212A (en) 1999-04-01 2000-10-20 Hitachi Ltd Method and device for decoding processing of encrypted data
US7430670B1 (en) * 1999-07-29 2008-09-30 Intertrust Technologies Corp. Software self-defense systems and methods
US6598163B1 (en) 1999-08-02 2003-07-22 Lucent Technologies Inc. Flash mixing apparatus and method
US6598161B1 (en) * 1999-08-09 2003-07-22 International Business Machines Corporation Methods, systems and computer program products for multi-level encryption
US6813354B1 (en) 2000-03-09 2004-11-02 Lucent Technologies Inc. Mixing in small batches
US20050131832A1 (en) * 2000-06-16 2005-06-16 Entriq Inc., Irdeto Access B.V. Separate authentication processes to secure content
US20040026502A1 (en) * 2000-08-17 2004-02-12 Tame Gavin Randall Transfer of verification data
US20040083380A1 (en) * 2001-02-16 2004-04-29 Marcus Janke Security module with volatile memory for storing an algorithm code
WO2003024138A1 (en) 2001-09-07 2003-03-20 Telefonaktiebolaget L M Ericsson (Publ) Dynamic security model
US20050273613A1 (en) * 2001-09-07 2005-12-08 Telefonaktiebolaget Lm Ericsson (Publ) Dynamic security model
US20030135730A1 (en) * 2001-10-19 2003-07-17 Paul Szucs Content protection and copy management system for a network
US20030123665A1 (en) * 2001-12-28 2003-07-03 Dunstan Robert A. Secure delivery of encrypted digital content
US20030177381A1 (en) * 2002-03-16 2003-09-18 Yoram Ofek Trusted communications system
US20040230797A1 (en) * 2002-03-16 2004-11-18 Yoram Ofek Remotely authenticated operation method
US20040237100A1 (en) * 2002-05-24 2004-11-25 Pinder Howard G. Validating client-receivers
US20030223582A1 (en) * 2002-05-31 2003-12-04 Amit Dagan Fast-software-implemented pseudo-random code generator
US20060205516A1 (en) * 2002-07-15 2006-09-14 Imagination Dvd Corp. Media playing system and process
US20040168063A1 (en) * 2003-01-31 2004-08-26 Dan Revital Virtual smart card device, method and system
US7245819B1 (en) * 2003-03-24 2007-07-17 Microsoft Corporation Cross-file DVR record padding playback
US20040220985A1 (en) * 2003-05-02 2004-11-04 Morris John R. System and method for producing functions for generating pseudo-random bit sequences
US20050037735A1 (en) * 2003-07-31 2005-02-17 Ncr Corporation Mobile applications
US20050060525A1 (en) * 2003-09-12 2005-03-17 Schwartz James A. Language for performing high level actions using hardware registers
WO2005031593A1 (en) 2003-09-30 2005-04-07 Inka Entworks, Inc. A method of synchronizing data between contents providers and a portable device via network and a system thereof
US20050185647A1 (en) * 2003-11-11 2005-08-25 Rao Goutham P. System, apparatus and method for establishing a secured communications link to form a virtual private network at a network protocol layer other than at which packets are filtered
US20050132207A1 (en) 2003-12-10 2005-06-16 Magda Mourad System and method for authoring learning material using digital ownership rights
US20050193191A1 (en) * 2004-02-27 2005-09-01 Sturgis Rod D. Method of identifying participants in secure web sessions
US20050232416A1 (en) * 2004-04-19 2005-10-20 Infineon Technologies Ag Method and device for determining a result
US20060294312A1 (en) * 2004-05-27 2006-12-28 Silverbrook Research Pty Ltd Generation sequences
US20060026688A1 (en) * 2004-08-02 2006-02-02 Pinkesh Shah Methods, systems and computer program products for evaluating security of a network environment
US20060090209A1 (en) * 2004-10-27 2006-04-27 Garay Juan A Method and apparatus for software integrity protection using timed executable agents
US20060109101A1 (en) * 2004-11-19 2006-05-25 Nec Corporation Security system
US20060184796A1 (en) * 2005-02-16 2006-08-17 Comcast Cable Holdings, Llc System and method for a variable key ladder
US20060200410A1 (en) * 2005-03-02 2006-09-07 International Business Machines Corporation Secure cell phone for atm transactions
US20060230102A1 (en) * 2005-03-25 2006-10-12 Murray Hidary Automated training program generation and distribution system
US20070220500A1 (en) * 2006-03-20 2007-09-20 Louisa Saunier Computer security method and computer system
US20070242039A1 (en) * 2006-04-17 2007-10-18 Mike Chen Pointing device with security capabilities

Non-Patent Citations (7)

* Cited by examiner, † Cited by third party
Title
Aug. 24, 2011 Office Communication in connection with prosecution of CN 2006 8003 6934.4.
Bruce Schneier, Applied Cryptography, Protocols, Algorithms and Source Code in C (2d ed, p. 3) (John Wiley & Sons, 1996).
Dianelos Georgoudis, "The ‘FROG’ Encryption Algorithm", (TecApro Intl., South Africa, Jun. 1998).
Dianelos Georgoudis, "The 'FROG' Encryption Algorithm", (TecApro Intl., South Africa, Jun. 1998).
Feb. 11, 2010 Office Communication in connection with AU 2006 298420 (2 pgs.).
Feb. 8, 2013 Office Communication in connection with prosecution of EP 06 79 6130.0.
Jun. 11, 2010 Office Communication in connection with prosecution of CN 2006 800 36934.4 (w/English translation).

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130219188A1 (en) * 2012-02-16 2013-08-22 Samsung Electronics Co. Ltd. Apparatus and method for reproducing contents in electronic device
US9836111B2 (en) * 2012-02-16 2017-12-05 Samsung Electronics Co., Ltd. Apparatus and method for reproducing contents in electronic device

Also Published As

Publication number Publication date Type
EP1932275A4 (en) 2013-03-13 application
CN101278517A (en) 2008-10-01 application
US20100153717A1 (en) 2010-06-17 application
WO2007039896A2 (en) 2007-04-12 application
WO2007039896A3 (en) 2007-11-01 application
US20110271104A9 (en) 2011-11-03 application
EP1932275B1 (en) 2016-11-23 grant
EP1932275A2 (en) 2008-06-18 application
CN101278517B (en) 2012-03-21 grant

Similar Documents

Publication Publication Date Title
US6311270B1 (en) Method and apparatus for securing communication utilizing a security processor
US6185685B1 (en) Security method and system for persistent storage and communications on computer network systems and computer network systems employing the same
US7546641B2 (en) Conditional access to digital rights management conversion
US7296154B2 (en) Secure media path methods, systems, and architectures
US6907127B1 (en) Hierarchical key management encoding and decoding
US20050144468A1 (en) Method and apparatus for content protection in a personal digital network environment
US20010029581A1 (en) System and method for controlling and enforcing access rights to encrypted media
US20060137015A1 (en) System and method for secure conditional access download and reconfiguration
US20070220279A1 (en) Method and apparatus for content protection in a personal digital network environment
US20060259790A1 (en) Implementation of an integrity-protected secure storage
US20090249492A1 (en) Fabrication of computer executable program files from source code
US20050210241A1 (en) Method and apparatus for digital rights management using certificate revocation list
US20050216419A1 (en) Method and apparatus for acquiring and removing information regarding digital rights objects
US20050268098A1 (en) Method and apparatus for transmitting rights object information between device and portable storage
US7324644B2 (en) Scheme for transferring copyright protected contents data using radio link layer authentication/encryption
US20120173877A1 (en) Method and apparatus for building a hardware root of trust and providing protected content processing within an open computing platform
US7270193B2 (en) Method and system for distributing programs using tamper resistant processor
US20050210279A1 (en) Authentication between device and portable storage
US20050210236A1 (en) Digital rights management structure, portable storage device, and contents management method using the portable storage device
US20050268346A1 (en) Method and apparatus for playing back content based on digital rights management between portable storage and device, and portable storage for the same
US7533276B2 (en) Program execution device
US20050010536A1 (en) Secure communication and real-time watermarking using mutating identifiers
US20060155650A1 (en) Method and device for consuming rights objects having inheritance structure in environment where the rights objects are distributed over plurality of devices
US20060002561A1 (en) Apparatus and/or method for encryption and/or decryption for multimedia data
US20020166056A1 (en) Hopscotch ticketing

Legal Events

Date Code Title Description
AS Assignment

Owner name: NDS LIMITED,UNITED KINGDOM

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:SANDLER, LEONID;SELLA, YARON;WAISBARD, EREZ;REEL/FRAME:020163/0102

Effective date: 20071113

Owner name: NDS LIMITED, UNITED KINGDOM

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:SANDLER, LEONID;SELLA, YARON;WAISBARD, EREZ;REEL/FRAME:020163/0102

Effective date: 20071113

AS Assignment

Owner name: J.P. MORGAN EUROPE LIMITED,UNITED KINGDOM

Free format text: SECURITY AGREEMENT;ASSIGNORS:NDS LIMITED;NEWS DATACOM LIMITED;REEL/FRAME:022678/0712

Effective date: 20090428

Owner name: J.P. MORGAN EUROPE LIMITED, UNITED KINGDOM

Free format text: SECURITY AGREEMENT;ASSIGNORS:NDS LIMITED;NEWS DATACOM LIMITED;REEL/FRAME:022678/0712

Effective date: 20090428

AS Assignment

Owner name: NDS HOLDCO, INC.,NEW YORK

Free format text: SECURITY AGREEMENT;ASSIGNORS:NDS LIMITED;NEWS DATACOM LIMITED;REEL/FRAME:022703/0071

Effective date: 20090428

Owner name: NDS HOLDCO, INC., NEW YORK

Free format text: SECURITY AGREEMENT;ASSIGNORS:NDS LIMITED;NEWS DATACOM LIMITED;REEL/FRAME:022703/0071

Effective date: 20090428

AS Assignment

Owner name: NDS LIMITED, UNITED KINGDOM

Free format text: RELEASE OF INTELLECTUAL PROPERTY SECURITY INTERESTS;ASSIGNOR:NDS HOLDCO, INC.;REEL/FRAME:025940/0710

Effective date: 20110310

Owner name: NEWS DATACOM LIMITED, UNITED KINGDOM

Free format text: RELEASE OF INTELLECTUAL PROPERTY SECURITY INTERESTS;ASSIGNOR:NDS HOLDCO, INC.;REEL/FRAME:025940/0710

Effective date: 20110310

AS Assignment

Owner name: NEWS DATACOM LIMITED, CALIFORNIA

Free format text: RELEASE OF PATENT SECURITY INTERESTS;ASSIGNOR:J.P.MORGAN EUROPE LIMITED;REEL/FRAME:026042/0124

Effective date: 20110310

Owner name: NDS LIMITED, CALIFORNIA

Free format text: RELEASE OF PATENT SECURITY INTERESTS;ASSIGNOR:J.P.MORGAN EUROPE LIMITED;REEL/FRAME:026042/0124

Effective date: 20110310

AS Assignment

Owner name: CISCO TECHNOLOGY, INC., CALIFORNIA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:NDS LIMITED;REEL/FRAME:030258/0465

Effective date: 20130314

CC Certificate of correction
FPAY Fee payment

Year of fee payment: 4